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The entanglement cost of a quantum channel is the minimal rate at which entanglement (between 
sender and receiver) is needed in order to simulate many copies of a quantum channel in the presence 
of free classical communication. In this paper we show how to express this quantity as a regularised 
optimization of the entanglement formation over states that can be generated between sender and 
receiver. Our formula is the channel analog of a well-known formula for the entanglement cost of 
quantum states in terms of the entanglement of formation; and shares a similar relation to the 
recently shattered hope for additivity. 

The entanglement cost of a quantum channel can be seen as the analog of the quantum reverse 
Shannon theorem in the case where free classical communication is allowed. The techniques used 
in the proof of our result are then also inspired by a recent proof of the quantum reverse Shannon 
theorem and feature the one-shot formalism for quantum information theory, the post-selection 
technique for quantum channels as well as von Neumann's minimax theorem. 

We discuss two applications of our result. First, we are able to link the security in the noisy-storage 
model to a problem of sending quantum rather than classical information through the adversary's 
storage device. This not only improves the range of parameters where security can be shown, but 
also allows us to prove security for storage devices for which no results were known before. Second, 
our result has consequences for the study of the strong converse quantum capacity. Here, we show 
that any coding scheme that sends quantum information through a quantum channel at a rate larger 
than the entanglement cost of the channel has an exponentially small fidelity. 
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I. INTRODUCTION 



The quantification of the information theoretic power of quantum channels is one of the most fundamental problems 
in quantum information theory. Of particular interest is thereby the study of a channel's capacity for information 
transmission. This quantity corresponds to the number of bits m that can be sent reliably when using the channel 
n times using optimal encoding and decoding operations. Unlike classical channels, quantum channels have various 
distinct capacities, depending on the kind of information that is sent (e.g. classical or quantum) or on the kind of 
assistance that is allowed (e.g. free entanglement or free classical communication). Important examples of quantum 
channel capacities include the entanglement assisted classical capacity Ce [I], and the classical communication as- 
sisted quantum capacities Q^, and depending on the direction of the assisting commimication [2H1]. 

One way of tackling the problem of capacities is to think more broadly in terms of channel simulations. For 
example, the process of sending m bits reliably using n uses of a channel £ can be understood as a simulation of m 
perfect, noise-free, channels using n copies of £. The capacity of the channel £ is then simply the rate m/n at which 
such a simulation is possible in the limit of large n. One can also turn the problem upside down and ask: What is the 
optimal rate at which a perfect channel can simulate a noisy one? When the simulation can consume free entanglement 
between the sender and the receiver, this question is answered by the quantum reverse Shannon theorem. It states 
that the optimal rate is given by the entanglement assisted classical capacity Ce [SI IS]' Apart from its deep con- 
ceptual appeal, the quantum reverse Shannon theorem led to the proof that the Ce is in fact a strong converse capacity. 

It is natural to ask how these capacities change in the presence of other free resources. In this work, we consider 
the simulation of a noisy quantum channel £ by a noise-free channel in the presence of free classical communication. 
It turns out not to matter whether we allow free classical forward, backward, or even two-way communication, the 
capacity turns out to be the same in all scenarios. The problem we are considering can therefore be understood 
as the 'reverse problem' for all three classical communication assisted quantum capacities. Note that by quantum 
teleportation [7], the perfect quantum channel can equivalently be replaced with perfect entanglement. The central 
question of this paper can thus be summarized as 



We call this rate the entanglement cost Ec of a quantum channel. Our main contribution in this paper is to prove 
the following formula 



where the maximization is over all purifications i/;" of input states to the n-fold tensor product quantum channel 
f ®" and T stands for the identity channel on the purifying system. The entanglement of formation Ep is computed 
between purifying system and channel output; it is defined as 



where the infimum ranges over all pure state decompositions pab — '^iPiPAB^ ^^'^ ^i') denotes the von Neumann 
entropy. Note that expression ([T]) involves a regularization, and is therefore not a single-letter formula. Even if we 
would know that we can restrict the maximization to non-entangled input states, equation ([I]) would still not reduce 
to such a formula, due to Hasting's counterexample for the additivity of the entanglement of formation O [9] Note 
also that Ec is generally larger than Q^j^in fact more strikingly, there exist so-called bound entangled channels £ 
(for instance entangling PPT channels) for which Ec{£) > Q^{£) = 0. This fact highlights an important difference 
compared to the case of free entanglement where the quantum reverse Shannon theorem implies that the correspond- 
ing rates are equal. In particular, when Ec{£) > Q^^{£), the concatenated protocol which first simulates £ from a 
noiseless channel and then the noiseless channel from £ will result in a net loss. 



^ However we want to emphasize that we can compute exphcit upper bounds for Eq, which are particularly useful for the applications 
given below. 

^ The same applies to Q_> and Qt— since both are smaller or equal to Q<->. 



At what rate is entanglement, in the form of ebits, needed in order to 
asymptotically simulate a quantum channel £ , when classical communi- 
cation is given for free ? 




(1) 




(2) 
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As the name entanglement cost suggests, Ec{£) is the quantum channel analog of the entanglement cost of quantum 
states Ec{pab), which corresponds to the rate of entanglement needed in order to generate a bipartite quantum state 
Pab HO] ■ Our formula ([T]) can be seen as the channel analog of the following well-known result for the quantum state 
problem [TT] 



EcipAB) = lim -Ef{pTb) ■ (3) 



and the gap between Ec(E) and Q^{£) has its analog in the gap between Ec{pab) and E£,{pab)i the distillable 
entanglement. 



We present two applications. The first one concerns the security in the noisy-storage model [12H14| . For the first 
time, we relate security in this model to a problem of sending quantum rather than classical information through the 
adversary's storage device. In particular, we show that any two-party cryptographic primitive can be implemented 
securely whenever 

Ec{£)-v<\, (4) 
where the adversary's storage is of the form jji jg the number of qubits transmitted during the protocol, and 



V is the storage rate (see Section IV. 1 for precise definitions). Our analysis improves the range of parameters when 
security can be obtained. We illustrate our results with explicit calculations for a number of specific channels. In 
particular, we obtain non-trivial bounds for dephasing noise and for any qubit channel - for instance the amplitude 
damping channel. 

The second application of our result is an upper bound on the strong converse capacity for sending quantum 
information. The strong converse capacity is the minimal rate above which any attempt to send information neces- 
sarily has exponentially small fidelityP] The strong converse capacity for sending classical information is known to be 
equal to the classical capacity for a selected number of channels [15^ , or under additional assumptions [THl E] . For 
many channels there are also upper bounds known [3 UHl [19] , but a general formula for the strong converse classical 
capacity is not known. Understanding the strong converse capacity for sending quantum information turns out to be 
an even more elusive problem, and the only previous result relies on a statement involving the transmission of classical 
information [S]. Here, we make progress by showing that any coding scheme sending quantum information (using free 
forward, backward or two-way classical communication) at an asymptotic rate higher than the entanglement cost iJ^, 
must have an exponentially small fidelity. 

The proof of our main result ([T]) is based on one-shot information theory, which makes statements about struc- 
tureless resources avoiding the usual requirement of indepenedence and identical distribution (i.i.d.). The role of 
von Neumann entropies in the i.i.d. scenario is taken by min- and max-entropies from the smooth entropy formal- 
ism 20 26j. We work in this formalism and the proof of our main result is conceptually very similar to the proof 
of the quantum reverse Shannon theorem given in [S]. In order to prove the direct part of ([!]), we need to show the 
existence of a channel simulation for f®", whose asymptotic rate of entanglement consumption is upper bounded by 
Ec{£)- That is, we need to construct a completely positive and trace preserving (CFTP) map that is arbitrarily 
close to f^" in the diamond norrrj^ and that uses local operations and classical communication as well as ebits at a 
rate of at most Ec{£)- Here it is worth noting that even though the channel we wish to simulate has i.i.d. structure, 
the channel simulation also has to work on non-i.i.d. inputs. The crucial idea in order to deal with this fact is to 
employ the post-selection technique for quantum channels [28] , which is a tool to bound the distance in diamond 
norm between two completely positive and trace preserving (CFTF) maps. The technique upper bounds this distance 
by the distance arising from the purification of a special de Finetti input statej^ With this, it is sufficient to find 
a CPTP map that creates this state and to quantify how much entanglement this map consumes. Since the state 
is a purification of a de Finetti state (and not a do Finetti state itself) it does not have i.i.d. structure. In order 

to deal with this fact we employ the one-shot entanglement cost for quantum states e''^\pab,£), which quantifies 
how much entanglement is needed in order to create one single copy of a bipartite quantum state pab using local 
operations and classical communication [291 The resulting entanglement cost of the channel simulation is then 
upper bounded by an expression similar to ([T]), but with the maximization over input states and the minimization 



^ Note that the strong converse capacity is greater or equal than the standard capacity (which is defined as the minimal rate above which 
the fidelity does not approach one). 

The diamond norm is the dual of the completely bounded norm 1271 . 
^ A de Finetti state consists of n identical and independent copies of an (unknown) state on a single subsystem. 

® This is in contrast to the quantity Eq{pab) mentioned before, which answers the question of how much entanglement is needed in the 
asymptotic i.i.d. regime. 
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in the definition of the entanglement of formation interchanged. Finahy, in order to arrive at ([T]), we discretize the 
set of Kraus decompositions of £ and apply von Neumanns minimax theorem to swap the minimization and the 
maximization [3T]. The proof of the converse follows a standard argument applied to the one-shot entanglement cost. 

This paper is structured as follows. In Section In] we introduce notation, definitions and state some basic lemmas. 



In particular, we review the results of |29| about the one-shot entanglement cost of quantum states. In Section III 



we derive our main result; we define and quantify the entanglement cost of quantum channels. This is followed by 



a discussion of applications in Section IV Finally we end with a summary and give an outlook (Section [VJ). The 



arguments are based on various technical statements, which are proven in Appendices |A| - [C| 



II. PRELIMINARIES 



We assume that all Hilbert spaces, in the following denoted %, are finite-dimensional. The dimension of T-La is 
denoted by \A\. The set of linear operators on T-L is denoted by C{'H) and the set of positive semi-definite operators 
on % is denoted by V{'H). We define the sets of sub-normalized states 5<(H) = {p G V{'H) : tr[p] < 1}, normalized 
states S{n) = {p e Vin) : tr[p] = 1}), and normalized pure states V(-H) = 6 S{n) : \tp) G V.}. The 

tensor product of Ha and Hb is denoted by Hab = ®'Hb- Given a multipartite operator pab G 'Pi'^As), 
we write pA — tTsipAB] for the corresponding reduced operator. For Ma G £{71 a), we write Ma = Ma ® 1b 
for the enlargement on any Hab, where Is denotes the identity in C{'Hb)- For T-La, Hb with orthonormal bases 
{|i)B}l=i and \A\ — \B\, the canonical identity mapping from C{Ha) to C{Hb) with respect to these 
bases is denoted by Ia-j-b, i-e. lA^Bi\i){j\A) ~ A linear map Sa^b ■ ^(Ha) C,{Hb) is positive if 

£a^b[pa) S T-'^Hb) for all pA G V{Ha)- It is completely positive if the map {£a^b ®'^c^c) is positive for all 
He- Completely positive and trace preserving maps are called CFTP maps or quantum channels. The support of 
p S V{l-L) is denoted by supp(p), the projector onto supp(p) is denoted by p° and tr — rank(p), the rank of p. For 
p £ V{'H) we write ||p||oo for the operator norm of p, which is equal to the maximum eigenvalue of p. The trace norm 

of M e C{n) is defined as || Af || i = tr ^/MHd , and the Hilbert-Schmidt norm of M is given by ||M||2 = 0r [MH-I]. 

Recall the following standard definitions. The von Neumann entropy oi p £ 'P{H) is defined as H(p) — — tr[/3logp]j^ 
and the conditional von Neumann entropy of A given B for pab €E 'P{'Hab) is given by 

H{A\B)p - H{AB)p - H{B)p . (5) 
Definition 1. Let pab G S{'Hab)- The entanglement of formation of pab is defined as 

Ef{pab)= inf y^p,H{A)p.= inf H{A\R)p , (6) 

where the infimum ranges over all pure states decompositions pab — ^iPiPAB Par = '^iPiPA ® 
Definition 2. Let pab G ViJ-LAB)- The alternative max- entropy of A conditioned on B is defined as 

Ho{A\B)p= sup logtr[p%(l^®CTB)] • (7) 

<TBe5(«i3) 

In the literature this quantity is also known as conditional max-entropy |20l I26| or conditional zero-Renyi en- 
tropy We will evaluate the alternative conditional max-entropy in particular on quantum-classical states. 

Lemma 3. Let pab G 'P{'Hab) with pab — J2keK Pa Pa ^ T^C^a), and the \k)B mutually orthogonal 

(i.e. the state is classical on B). Then, 

HoiA\B)p^mi,^HoiA)p. . (8) 

keK 



log denotes the logarithm to base 2. 
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Proof. We calculate 



Ho{A\B)p = max logtr [pAsilA ® ctb) 

aBeSCHs) 



log max tr 

CBeS(-HB) 



log max tr 

aBeS{HB) 



as ■ {J2\k){k\B-tr\{p'x) 



= log 



Y.\k){k\B-tT 



[Pa) 



— log max tr 

k 



[Pa) 



ma.x Hq{A) ^ 

k 



(9) 
(10) 

(11) 

(12) 

□ 



Smooth entropy measures are defined by extremizing the non-smooth measures over a set of nearby states. We 
stick to the definitions as given in [53], because we will later crucially use the results therein. 

Definition 4. Let e > 0, and pab = Pa ® \k){k\B € S{Hab)- The smooth alternative max- entropy of A 
conditioned on B is defined as 



where 



H'^{A\B)p = sup Ho{A\B)^ , 

Pab<^'31^(pab) 



^IApab) = {pAB e V{n) ■■Pab=Y.Pa® \k){k\B, \\pab - Pab\\i < e} 



(13) 



(14) 



We will also use the following distance measure for quantum states. For p,(T (z S< {%) the purified distance is 
defined as [25i Definition 4] 



P{p,a) = Jl~F^{p,a) , 



(15) 



where F{- , •) denotes the generalized fidelity (which equals the standard fidelitjQ if at least one of the states is 
normalized) , 



Fip, a) = F{p, a) + ^(1 - tr[p]) (1 - tr[a]) 



(16) 



The purified distance is a metric on S<{H) [25, Lemma 5]. Henceforth we call p, a E S<{H) e-close if P{p,a) < e 
and denote this by p a. 

How much entanglement that is needed in order to create a single copy of a bipartite state pab is discussed 
in [inilllllMlED]- Here we state the main result of [25] ■ 

Definition 5. Consider a bipartite system with parties Alice and Bob, where Alice controls a system Ha and Bob 
T-Lb- Furthermore let e > and pab G 3(1-1 a ®'Hb)- An e- faithful one- shot entanglement dilution protocol for pab is 
a CPTP map T that consists of using a maximally entangled state of Schmidt rank i?, applying local operations at 
Alice's side, local operations at Bob's side, classical communication between Alice and Bob, and outputs a state that 
is £-close to Pab- logi? is called dilution cost of the one-shot entanglement dilution protocol. 

Definition 6. Let e > and pab € S{T-Lab)- The minimal dilution cost of all e-faithful one-shot entanglement 
dilution protocols for pab is called e-faithful one-shot entanglement cost of pab and is denoted by e]^\pabi£)- 

Proposition 7. [^ Theorem 1] Let e > and pab € S{T-Lab)- Then, 



min H'^^'{A\R)p<E)^\pAB,e)< min Hy\A\R)p, 
where the minimum ranges over all pure states decompositions pab = J2iPiPAB Par — J2iPiPA N)(*l-R- 



(17) 



The fidelity between p, o" G iS<('H) is defined as F{p,a) = 
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The idea for the achievabihty is as follows. For any pure state decomposition pab = TliiPiP^AB Alice can locally 
create the classical-quantum state pabr = J2iPiPAB ^ N)(*l-Rj and then, conditioned on the index z, just teleport 
the -B-part of the pure states to Bob. Minimizing over all pure state decompositions, a straightforward analysis 
shows that the resulting entanglement cost is bounded as in Proposition [7j 

Remark 8. The bounds given in (17) also hold if we only allow one-way classical communication (forward or 
backward) . 

III. ENTANGLEMENT COST OF QUANTUM CHANNELS 
III.l. Main Result 

We are now in the position to define the entanglement cost of quantum channels and prove the main result of this 



paper, Theorem 11 



Definition 9. Consider a bipartite system with parties Alice and Bob. Let e > and £ : C{Ha) — > 1^{T~Lb) be a 
CPTP map, where Alice controls T-La and Bob T-Lb- A one-shot channel simulation for £ with error e is a CPTP map 
J- that consists of using a maximally entangled state of Schmidt rank _R, applying local operations at Alice's side, 
local operations at Bob's side, classical communication between Alice and Bob, and 

\\J''£h<e, (18) 



where || • |jo denotes the diamond norm (Definition 31). logi? is called entanglement cost of the one-shot channel 
simulation. 

Definition 10. Let £ : C{'Ha) ~^ ^{^b) be a CPTP map. An asymptotic channel simulation for f is a sequence 
of one-shot channel simulations for S*^" with error e„, such that lim„_).oo £n = 0. The entanglement cost of the 
simulation is limsup^ ^°sRn 



n^QQ 



Tiieorem 11. Let £a^b ■ )^{T~La) ^{T~Lb) be a CPTP map. Then, the minimal entanglement cost Ec{£a-^b) of 
an asymptotic channel simulation for £a^b is given by 

Ec{£a^b) = lim - maxEp {{£f!^B^lA') (^aaO) , (19) 
where Vaa' ^ V{nT «) n'^) and Ha' = Ha- 



Proof. We first show that the right-hand side of (19) can be achieved (Proposition 14), and thereafter that it is also 



a lower bound (Proposition 15). □ 



III.2. Proof: Achievability 

The proof proceeds in three steps leading to Proposition [M] The basic idea is as follows. Given a quantum 
channel £, we need to show the existence of a sequence of one-shot channel simulations with asymptotically vanishing 



error, and an asymptotic entanglement cost upper bounded by the right-hand side of (19). The crucial step is that 



by the post-selection technique for quantum channels (Proposition 33 1 , it is sufficient to come up with CPTP map 
(which consists of using maximally entangled states, local operations, and classical communication) that works for 
the purification of one special de Finetti input state. This reduces the problem to the one-shot entanglement cost of 
quantum states (Proposition [?]). Thus all that remains to do, is to estimate the one-shot entanglement cost of the 
state given by f®" applied to the purification of the special de Finetti input state (in the limit n — oo). 

Lemma 12. Let £a^b ■ C{'Ha) ^ C{nB) be a CPTP map. Then, 

Ec{£a-^b) < inf sup Y^pkH{B)^, , (20) 

where the infimum is over all Kraus decompositions {M\^g} of £a^b, i^B — ^-^I-s-bV-'a and pk = 

tr ImI^s^PaMX^s^. 
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Proof. We construct a sequence of one-shot channel simulations J^" with asymptotically vanishing error £„, and an 
asymptotic entanglement cost '"^J^" as in (20). Without lost of generality we choose J^" to be permutation-covariant ^ 
The post-selection technique (Proposition 33 1 applies to permutation-covariant quantum channels and upper bounds 
the error by 

= WSfZs - -^a^bIIo < (« + 1)'^''-' • ||((ff "b - J'a^b) ®TT®Ie) {Caa'e)\1 , (21) 

where Caa'B ^ purification of the de Finetti state C,aa' — / V'^S'^l'/'viA') with Vaa' G V{Ha ® T^a'), 'Ha' — 'Ha 
and d(-) the measure on the normalized pure states on T-La ® Ha' induced by the Haar measure on the unitary group 
acting on Ha ^ Ha', normalized to J d(-) = 1. Hence it is sufficient that the channel simulation JT" creates the state 

U^BA'E = I" B ® IT ® Ie) (Ga'e) , (22) 



up to an error o ( (?i + 1)^ l'^' ) in trace distance, for an asymptotic entanglement cost smaller than (20 1. 



Let Sn > 0- Since Caa'e pure, the 5„-faithful one-shot entanglement cost for uJqa'E (Proposition [T]) takes the 
form 

E^c'\^BA'E,Sn)< inf h',"/\b\R)^. , (23) 

where the infimum ranges over all Kraus decomposition {M^^^} of £^^3 ^'^'^ 

^A-BER = E M'^XbCaa'e M2'Xb ^ ^ \k){k\R • (24) 



Using a corollary of Caratheodory's theorem (Lemma 34), we know that 



^ J ^TaA^aa') - E 9. (V'iA')^" , (25) 
with e V(Ha ® Ha'), N^{n+ 1)2(1^1'-!) and {qj}^^i a probability distribution. This allows us to write 

N ^ 

'^Ir^T.^,T.^^aXb{^'a) ^ M'^^Xb^ ®\k){kU. (26) 



One particular choice for a Kraus decomposition {M^^g} of £T,b ™^ (23) is then to choose a Kraus decomposition 
for £a^b and then take this decomposition for every tensor product factor. Thus we find 

E^c\^lA-E.5n) < ^ inf ^ h',-/'{B\R)^. , (27) 

where the infimum ranges over all Kraus decompositions {M^^g} of Sa^b, and = SjLi Ij^br "with 

^'br^J2^^a^b^'aM^a^b^ ®\k){k\R. (28) 

k 

But by a property of the smooth alternative conditional max-entropy (Lemma |26[ ) this implies 

El^\^BA'E.^n) < inf maxi/^"/'(B|i?), + 2 (j^p - l) • log(n + 1) . (29) 



This can be seen as follows. First, Alice and Bob create shared randomness using classical communication. Then, Alice applies a random 
permutation vr on the input system chosen according to the shared randomness. This is followed by the original map (which might not 
yet be permutation-covariant), and Bob who undoes the permutation by applying 7r~^ on the output system. If needed, the classical 
communication cost of this procedure can be kept sub- linear in n by using randomness recycling, as discussed in O Section IV. D]. 
Alternatively, one could also use a sub-linear amount of entanglement to assure the permutation covariance. 
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Using the asymptotic equipartition property for the smooth alternative conditional max-entropy (Lemma 30 1 we 
arrive at 



inf r[v&yiH{B\R)^j > + ^/n ■ log 



m + 3) • + 2 {\A? 1) • log(n + 1) . (30) 



In summary, there exists a (S„-faithful (measured in purified distance) one-shot entanglement dilution protocol J^" for 
the state w^^'B ^^r an entanglement cost as given in (30). 

Now we choose 5n = \{n + l)^(^~l'^l ) and the entanglement cost becomes 



inf ma.xH{B\R)^, } + 2 (\A\^ - l) • log(n + 1) 



+ • log (|B I + 3) • v/4-log(n+l).(|^|2-l) 



(31) 
(32) 



By the equivalence of the purified distance and the trace distance (Lemma 35), the error measured in the trace 

distance is then upper bounded by (n + l)2(i~l"*l ). This together with (21) implies that there exists a sequence of 
one-shot channel simulations J^" for with error 



hm e„ = hm WS^'Xb - ^^bWo < 1™ (n+ l)i-l^l = 
where the entanglement cost of this asymptotic channel simulation is bounded by 

inf maxH{B\R)^j < inf sup > pkH{B)^k , 



(33) 



(34) 



where the infimum ranges over all Kraus decompositions {M^^^} of Sa^b, V'b — ^-^Ca^sV'a -^a-s-b ^^^^ Pk = 
tr [m5_rV^ M^^pl. □ 



Lemma 13. Let £a^b ■ >C('Hy 



CCHb) be a CPTP map. Then 



Ec{£a^b) < Ec{£a^b) ^ max£:j;^ {{£a^b ^T-A') [i^AA')) , 



(35) 



where ^jaa' G VCHa ® "Ha') and Ha' = 



Proof. The basic idea is to use a minimax theorem (Lemma 39 1 to interchange the infimum with the supremum in 
the preceding lemma (Lemma 12). To start with, we want to discretize the set of Kraus decompositions {Af^;} of 
£ with at most x Kraus operators. For this we note that every such Kraus decomposition {Mk} can be seen as a 
vector £ C-^'I^H^', by just writing all Kraus operators one after another in a vector Furthermore, we have 
J2k MlUk = Is and therefore G A/'^ = {w G C^'I^H^I | ||w||2 = We now discretize the set C of 

all Vy^ that correspond to a Kraus decomposition {Mk\ of £ with at most x Kraus operators, using a lemma about 



£-nets (Lemma 



38 



The lemma states that there exists a set Tx,e ^ 7^ with \Tx,e\ < 



= M(x,e), 



such that for every & 7^, there exists a v^.e & 7^,e with — Wx.£||2 < £• 



As the next step we consider the set T^^e of probability distributions {qj I^Li over 7^,e, and note for every such 



probability distribution, there exists a corresponding Kraus decomposition {y/qj ■ Mj^k}j of £. Restricting the 
infimum in (20) to F^ g, we find 



Ec{£a^b) < inf sup^g^ ^pj.kH{B) 



(36) 



Kraus decompositions with loss than x Kraus operators can just be filled up with zeros. 

For this note that Ij^xlh = || "Ylk ^k^k\\2, where the norm on the let hand side denotes the euclidian vector norm and the norm on the 
right hand side denotes the Hilbert-Schmidt matrix norm. 
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where ^^^^ = :^Mj^k^Ml^, and pj^k = tr M^^ki^M],^ 



To apply the minimax theorem (Lemma 39) to interchange the infimum and the supremum in (36), we need to 
check aU the conditions of Lemma [39l 

S{'Ha) is compact, convex set. To see that qj'^kPj,kH{B)^j.k is concave in -0^, we consider tpA — r^^^tp^ + 



with V'A^i G S={Ha) and A^'> + r^^) = 1. We define 



~(1) _ r^'^-p'^l ~{2) _ r^^'-vn 



Pj.k ' J.fc 



Pj.k 



with p'^^l = 



tr 



(2) i. 



Mj^ki^^M^ f, . Since fj^^ + f'^^l = f, we have by the concavity of the von Neumann 



entropy for = (TT^^' V'b = (2r^ 



that 



By multiplying this with qj ■ pj,k and taking the sum over all j, k we conclude 

Y,q,Y.p,,kH{B)^.^k > A'^-J2q,J2p^llH{B)^^..,k+r^^^-J2q,J2pflH{B)^.,. 



(37) 



(38) 



The function J2j Qj J2kPj->^-^i-^)^^-'' ^^^"^ continuous in ipA, since for any iPa^'^a ^ S{%a) with — V'aIIi — ^ 
for some (5 > 0, it follows from the monotonicity of the trace norm under CPTP maps and the continuity of the 
conditional von Neumann entropy (Lemma |42[ ) that 

(39) 



E9jE?'5-2^(^)v'^-'' -E'?jEp5-5^(^)^^-^I ^ 4<51og|i?| +2/i(<5) 



where h{-) denotes the binary Shannon entropy. 

r^_£ is a compact, convex set. Moreover 'Y^- qj 'YkPj.kH{B)^j,k is linear in {qj} and therefore in particular convex 
and continuous. By finally applying the minimax theorem (Lemma |39[) in (36), we find 



Ec{£a^b) < sup inf 



Since the function is concave, the infimum is taken on an extreme point and hence 



inf VpJ^A;i^(S)v-J•*^ = inf Vpfeff(B) 



(40) 



(41) 



where the second infimum ranges over all Kraus decompositions {Mfe} = g G 7^ ^ of £ . 

Now let < e < ^TTS]- ^he next step we show that for every Kraus decomposition {Mk\ ~ G T of there 



exists a Kraus decomposition {M^. g} = ^ G T^^e of £, such that 

\J2Pk.eHiB)^k., - J2PkH{B)^k I < 8sx\B\ log \B\ + 2h{2ex\B\ 



(42) 



where V'''" = ^Mfc^eV^/^,^, Pfc.e = tr 



rewrite (42), using Definition [T] to 

\Y,Pk..eH{B)^k^. - Y,PkHiB)^k\ = \HiB\R).^k„-H{B\R)^ 



, and h{-) denotes the binary Shannon entropy. To see this, we 

(43) 



where V'^^ = J^kPk.si'B^ \k){k\R and ipgj^ = Y/tPki^B ® To estimate (43) we want to use the continuity 

of the conditional von Neumann entropy (Lemmaj42|) , and for this we analyze 



^Pk.,e^B' ® \k){k\R - ^Pk-^^ ® \k){k\R 



Y,\MkAMle-Mki^M\ 



(44) 
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By the triangle inequality for the trace norm, the equivalence of the trace norm and the Hilbert-Schmidt norm 
(Lemma 36), and the sub-multiplicativity of the Hilbert-Schmidt norm (Lemma 37), we get 



k k 

<^(Ell^-^fc.^ll2-|IV'll2 
\ k 



{Mk^,-Mk)i^Ml 

{Mk^,-Mk)i^Ml 



+ |lMfc,,-M,||2.|lV'||2-||MLll: 



< ^/\B\ {sxVWl + X\AB\e) = 2ex\B\ 



(45) 
(46) 



(47) 
(48) 



Finally ( 42 ) follows by the continuity of the conditional von Neumann entropy (Lemma 42 ) . Thus we find together 
with (|40) and (tlTl) that 



Ec{£a^b) <sup inf YpkH{B)^,+8ex\B\\og\B\+2h{2ex\B\) 



(49) 



where the infimum goes over all Kraus decompositions {M^} Cz T oi £ and h[-) denotes the binary Shannon 

entropy. Finally note that 



^ ''' k \ k ) 



(50) 



where the infimum ranges over all Kraus decompositions {Affe} of f , "^aa' G V("H/i ® Ha'), and Ha' — T~La- But this 
infimum is actually taken for a decomposition of size at most (Lemma 44). Thus, if we set x = I^Pl^P and 

let e — )■ 0, we find 



Ec{£a^b) < sup Ep {{£a^b®'Ia') ii^AA')) 



(51) 



where i\jaa' G ^i'H-A ^ Ha') and Ha' — 'Ha- Since the entanglement of formation is continuous (Lemma 43) and 
S{'Ha) is compact, the supremum can be turned into a maximum. □ 



Proposition 14. Let £a^b ■ i^iJ-iA) ^ ^Ub) be a CPTP map. Then, 

Ec{£a^b) < lim ^maxEp {{£fZB <E> Ia') (^3^0) 
where Vaa' ^ V(HT «) Uf?) and Ha' = Ha- 



(52) 



Proof. T his follows from standard blocking arguments as in |32j . Namely, by applying the non- regularized achievability 
(Lemma 13) to the quantum channel £^"^g for some n > 1, we get 



Ec{£fI!,B) < - njaxi?^^ {{£f^B^^A') («a')) , 

" "^AA' 



(53) 



where V3a' ^ V{Hf ® -Hf,") and Ha' = Ha- Since n ■ Ec{£a^b) < i^cl^f" b)13 get the claim by letting 
n — >■ oo. □ 



This is immediate since a channel simulation for £^^g is a channel simulation for n copies of 



11 



III. 3. Proof: Converse 

The idea of the proof of the converse is that any asymptotic channel simulation for £a-^b must be able to produce 
any states of the form (gf^ ^g) Xf,") (V'aa') fo'^ n — > oo. But by the converse for the one-shot entanglement cost for 
quantum states (Propositionl7| we have a lower bound on the entanglement that is needed to do this. 

Proposition 15. Let Sa^b ■ C{Ha) -> C{Hb) be a CPTP map. Then, 

Ec{£a^b) > lim - maxEp {{SfZg^lA') (^aaO) • (54) 

n->oo n ip"^^, 

where i/^^^, E V(HT » Uf?) and Ha' = Ha- 

Proof. By the definition of an e-faithful one-shot channel simulation T" for (Definition [9|, we have that 

- £^''\\^ < e . (55) 

This implies in particular that 

max||((j-5^5 -ff:;^) ®Ia') irAA'A < e , (56) 

^ AA' 

where V'aa' ^ "^'('H^" (8)^5") and Ha' — T~La- Hence every e-faithful one-shot channel simulation J^" for needs 
to be able to produce any state of the form ®Ta') (V'Ia') ^'^ error e (measured in trace distance). But 

by the definition of the one-shot entanglement cost for quantum states (Definition [6]), the entanglement that is needed 
for this, is given by 

max4^) ((f^B ^^A') {rAA'),el2) , (57) 

'I'aa' 

where Vaa' ^ V(H^" ® ,") and Ua' V-a^ Thus we find for the entanglement cost of asymptotic channel 
simulations for £a^b that 

Ec{£a^b) > lim lim - maxi;g^ {{Sf':^^ ®^A') i^AA') , e/2) , (58) 

where Vaa' ^ V<{nT (g) nf?) and Ha' = Ha- But for 10%^, = {Sf^B^TA') (V'Ia'): the converse for the one-shot 
entanglement cost for quantum states (Proposition [?]) says that 

E^^\Lolj,,,e/2) > min Hf~^B\R)^. , (59) 

where the minimum ranges over all pure states decompositions ujgj^, — J^iPf'^BA' ^'^^ ^br ~ J^iPf^ls^ 
Now let cjg^ e ^^(^br) such that H^{B\R)l^,^ ~ i/o(-S|^)w"- Because the alternative conditional max-entropy 



is lower bounded by the conditional von Neumann entropy (Lemma 24 1, and since the conditional von Neumann 



entropy is continuous (Lemma 42), we find 

H/^{B\R)^r. = Ho{B\R)c,,^ > H{B\R)^^ > H{B\R)^^ ~ AnV2~e\og \B\ - 2h{V2~e) , (60) 

where h{-) denotes the binary Shannon entropy. Thus, we conclude by the definition of the entanglement of formation 
(Definition [1]) that 



min h/^'{B\R)^^> min H{B\R)^^ - AnV2elog\B\ - 2h{V2e) (61) 

= EF(ujBA')-^nVe\og\B\~2h{V2e) (62) 
= Ef {{Sf^B^^A') [rAA')) - 4^72^ log - 2h{V2~e) , (63) 



The factor 1/2 appears because the one shot entanglement cost for quantum states is defined in terms of the purified distance (Defini- 
tionjcj, cf. Lemma |35| about the equivalence of distant measures. 



12 



where the minimum ranges over aU pure states decompositions = ^iP^^s'A' ^br = SiPf'^S'* ® N)(*l-R' 
well as iP'Xa' e " (E) %'%?) with "H^/ = Ua- Together with @ and ^ this then impHes 

i^c(fA^B) > lim lim |- maxi;^. {{£T,b®^A') {Vaa')) - ^V2e\og \B\ ~ -h{^/2e)\ (64) 
= lim - maxS;^ {{Sf'^s <E,Ia') (^AaA')) , (65) 
where Vaa' ^ V(HT «) ,") and Ha' = Ha- □ 



III. 4. Properties 



Our main result (Theorem 11 ) also holds if we only allow one-way classical communication (forward or backward). 
This follows from the corresponding result about the entanglement cost of quantum states (Remark [slp^ 



We note that the non-regularized achievability (Lemma 13) together with the converse (Proposition |15[ ) imply the 
following. 

Corollary 16. Let Sa^b ■ C{Ha) ^ C{Hb) be a CPTP map. Then, 

maxi;c {{8a^b ^T-A') ii^AA')) < Ec{£a^b) < maxEp {{Sa^b ®1a') (V'aa')) : (66) 

'^AA' i'AA' 

where tpAA' G V('Ha ® V-a') and Ha' = Ha- 

The entanglement cost of quantum states Ec{pab) is zero if and only if pab is separable |33j . The corresponding 
statement about the entanglement cost of quantum channels holds as well. 

Corollary 17. Let Ea^b ■ C{nA) ^ /^(Hb) be a CPTP map. Then Ec{Sa-,b) = if and only if Sa^b is 
entanglement breakingp^ 

Proof. Clearly Ec{£a^b) — for every entanglement breaking channel, since then the channel simulation can be 
done without any entanglement To show the other direction, we estimate 

Ec{£a^b) = lim - max^j. {{£fXg®lA') {^^Ia')) > in&^Ec {{£a^b®Ia') (V^aa')) (67) 
> max£:sq((£A^s «)2:a') (V^aaO) > (68) 

^AA' 

where Esq denotes the squashed entanglement [S3] defined as 

EsqiPAB) = inf I ^ {H{AR)p + H{BR)p - H{ABR)p - H{R)p) : pabr is an extension of pAsj , (69) 

and the last step follows from [531 Corollary 6]. But now, since squashed entanglement is strictly positive on every 
entangled state ^35, Corollary 1], we find that Ec{£a-^b) > if f a->-_b is not entanglement breaking. □ 



IV. APPLICATIONS AND EXAMPLES 



In this section we present two applications of our formula for the entanglement cost of channels and calculate some 
examples. We start with problem of proving security in the noisy storage model and then turn to the problem of 
deriving bounds for the strong converse of quantum capacities. 



This is also true we think of the problem as simulating a noisy quantum channel from a perfect quantum channel (instead of simulating 
a noisy quantum channel from perfect entanglement), since in this case a maximally entangled state can always be distributed by the 
ideal channel. 

A quantum channel is called entanglement breaking if {£ji_yg (g) 1^') {''Paa') separable for all tpAA' G VCHa ® Ha')- 

The one-shot entanglement cost for t^g^/^ = (^^a^b ^-^a" (^aa'b)' ^^^^^ ^AA'E denotes the purification of the special de 

Finetti input state considered in the proof of Theorem is zero since i^gA'E separable. Hence the entanglement cost of the channel 
simulation becomes zero. 
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FIG. 1. Noisy-storage assumption: During waiting times At, the adversary can only use his noisy memory device to store 
quantum information. However, he is otherwise all powerful, and storage of classical information is free. 



IV. 1. Security in the Noisy Storage Model 

We will see below that Eq forms a natural quantity when considering security in the noisy-storage model [T^[T51[55] . 
It will enable us to extend the parameter regime where security of all existing protocols [T^HIll ISTl - HO] can be proven. 
The appeal of this model is that it allows to solve any cryptographic problem involving two mutually distrustful 
parties, such as bit commitment, oblivious transfer [T3] or secure identification [¥rj[32]. This is impossible without 
imposing any assumptions, such as a noisy quantum memory, on the adversary [i5H17] . Proposed protocols can 
thereby be implemented with any hardware suitable for quantum key distribution. 

Let us first provide a brief overview of the noisy-storage model as illustrated in Figure [T] - details can be found in 
e.g. [13] . The central assumption of the noisy-storage model is that the adversary can only store quantum information 
in a memory described by a particular channel : C{'Hin) C{'Hout)- In practise, the use of the memory device is 
enforced by introducing waiting times At into the protocol. This is the only restriction imposed on the adversary who 
is otherwise all-powerful. In particular, he can store an unlimited amount of classical information, and all his actions 
are instantaneous. This includes any computations, communications, measurements and state preparation that may 
be necessary to perform an error-correcting encoding and decoding before and after using his noisy memory device. 



In |13) , a natural link was formed between security in the noisy-storage model, and the information carrying capacity 
of the storage channel J- . Of particular interest were thereby memory assumptions that scale with the number m of 
qubits transmitted during the protocol]^ That is, the channel is of the form F = g'^'^ where v is referred to as 
the storage rate. It was shown that any two-party cryptographic problem can in principla^be implemented securely 

if uni 

C{£) ■v<\, (70) 

where C{E) denotes the strong converse classical capacity of the channel E (which is known to equal the classical 
capacity for certain classes of channels [H]). For the special case of £ =22, i-e. the one qubit identity channel, the 
condition simplifies to 

^<\- (71) 

This case is also known as bounded-storage [131 IMl HE] • For protocols involving qubits in a simple BB84 like scheme 
this is the best bound known today, although using a protocol with very high dimensional encodings can lead to an 
improvement up to < 1 [49j . 



In turn, this tells us how many qubits need to be send in order to achieve security against an attacker with a certain amount of storage. 
That is, by transmitting a sufficiently large number m of qubits. 
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When considering storing quantum information exchanged during the protocol, it may come as a surprise that the 
classical capacity should be relevant. Indeed, looking at Figure [l] it becomes clear that a much more natural quantity 
would be the quantum capacity off. Whereas we do not accomplish this goal, we make significant progress by linking 
the security to Ec{£)- 

Lemma 18. Let m be the number of qubits transmitted in the protocol, and let the adversary's storage be of the 
form J-' — f"?"^-™. Then for sufficiently large m any two-party cryptographic primitive can be implemented securely 
in the noisy-storage model if 

Ec{£) -vk]^. (72) 



Proof. Consider the case of bounded, noise-free, memory. Note that ( 71 1 from [13] tells us that security can be 
achieved for large enough m if the dimension d of the adversary's storage device is strictly smaller than d < 2™/^. 
Now, suppose by contradiction that security could not be achieved with a storage of the form = where n — v-m 
and Ec{£) ■ n < \ogd. However, then there exists a successful cheating strategy also in the case of bounded storage of 
dimension d: the adversary could simply simulate f using an entangled state of dimension d with logd — Ec{£) • n, 
possibly using additional classical forward communication provided by his unlimited classical storage device. Hence 
for large enough to, security can be achieved if Ec{£) ■ < ^ as claimed. □ 

Note that for small m, a corresponding one-shot quantity Eq'^ is relevant (but is not discussed in this work)j^ It 
should also be noted that our bound provides a further improvement apart from replacing C by Ec, as we no longer 
explicitly require any strong converse behavior. This is implicitly provided by our simulation argument. 

At first glance, our improved bound may appear rather unsatisfying. How could we hope to use this bound to make 
explicit statements when the formula for Ec involves regularization? First of all, note that for any entanglement 
breaking channel £, Ec{£) — 0, which leads to immediate security bounds: security can then be attained for any 
storage rate v. However, we can show security even for a much larger class of entanglement preserving channels. We 
now show that even though it is unclear how to calculate Ec explicitly, we can nevertheless obtain improved bounds. 
The key to such bounds is Lemma [13] which gives us 

Eci£A^B) < E}j{£a^b) = maxEp {{£a^b<»Ia') H^aa')) , (73) 

■>Paa' 

where ipAA' G V{Ha ®T-La') and T-La' — T~La- Most channels considered in the noisy-storage model are qubit channels, 
and for these an exact formula for the entanglement of formation was shown in [50j 

Ef {{£a^b®Ta-) {ipAA')) ^h(^^ + ^- ^1~C^ {{£a^b®Ta') (^aa'))) , (74) 

with h{-) the binary Shannon entropy, and the concurrence 

C{p) = max {O, - - - yXl} , (75) 

with Ai's the eigenvalues of pp in decreasing order, p — (uy ® (Ty)p*{ay (g) ay) with p* the complex conjugate of p in 
the canonical basis, and ay — . Furthermore we know from [511 152] that for ipAA' pure 

C ii£A^B (^^A') {''PaA')) ^ C {i£A^B ®^A') {<PaA')) ■ C'iijAA') , (76) 

where 4'aa' denotes the maximally entangled state. Since C(V'aa') < 1, it follows 



Eh{£A^B) = ^ + ^ • V'^-Cm£A^B<»lA' 



, (77) 



However, statements for any finite m can be made using our results (although the resulting bounds might not be optimal). 
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that is, it only remains to compute C(-) for the Choi-Jamiolkowski state of the channel. This can be done explicitly 
using ( 75 ) for any qubit channel of interest. To obtain a bound for when security can be achieved we thus can calculate 



when the condition 



A-^B 



1 

<2 



(78) 



is fulfilled. Figures [2] and |3] illustrate the improvements obtained for depolarizing and dephasing noise respectively. 
Note that since previous bounds involved the classical capacity, dephasing noise was no better than mere bounded 
storage. Using our new bound, however, we obtain non-trivial bounds even for this case. Figure |4] provides security 

bounds for the one qubit amplitude damping channel fdamp(p) — EqpEq + EipEi where Eq = ^ | and Ei — 









No previous security bound was known for this channel. 




FIG. 2. Depolarizing channel. Se- FIG. 3. Dephasing channel. Be- piQ 4 Amplitude damping chan- 
curity was previously known below f^i'^ security was no better than for jjgj security statement was 



the dashed line. Now for (r, ly) in- 
side the solid line. 



bounded storage, left of dashed line. 
Now for (r, 1/) inside the solid line. 



known previously. Now for (r, i/) in- 
side the solid line. 



IV. 2. An Upper Bound on the Strong Converse Quantum Capacity 

To determine a quantum channel's capacity for sending information, two aspects need to be addressed. First of all, 
one needs to show that the capacity can be achieved. That is, there exists some coding scheme that allows to transmit 
information reliably at any rate up to the capacity. Second, however, the capacity should really form a threshold for 
information transmission. That is, if one tries to send information at a rate above the capacity, then there exists no 
coding scheme that allows to send information without any error. Such a statement is also known as a weak converse. 

This however, does not yet exclude the possibility of sending information with a small error at a rate that exceeds 
the capacity. The minimal rate for which the success in transmitting information drops exponentially with the number 
of channel uses, is known as the strong converse capacity. The strong converse capacity is appealing since it really 
gives a sharp threshold for information transmission. But to determine the strong converse capacity forms a challenge 
even when it comes to sending classical information. Only when restricted to non-entangled input states [ini [T7] or 
certain classes of quantum channels [15' , it is known that the strong converse classical capacity is actually the same as 
the classical capacity. However, various upper bounds on the strong converse classical capacity are known [5| 118 1 fT9 ] . 
For example, the quantum reverse Shannon theorem shows that the entanglement assisted classical capacity Ce and 
its strong converse version are identical [S]. Of course Ce is then also an upper bound on the unassisted strong 
converse classical capacity. In addition, the result immediately implies that the entanglement assisted quantum 
capacity Qe = Ce/'2 and its strong converse version are identical. Thus, Q^; is an upper bound on the unassisted 
strong converse quantum capacity. 

As the second application of our result, we prove a new upper bound on the strong converse quantum capacity. 
Similar to the quantum reverse Shannon theorem jl] , we employ the idea of a channel simulation to prove that when 
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we send quantum information at a rate exceeding Ec, then the fidelity gets exponentially small. Our bound holds for 
all channels. To start with, let us first define the notion of quantum capacity more formally. 

Definition 19. Consider a bipartite system with parties Alice and Bob. Let e > and £ : C{T-La) C{T-Lb) be 
a CPTP map, where Alice controls T-La and Bob Hb- An e-error code for £ consists of an encoding CPTP map 



^) — Ha on Alice's side, and a decoding CPTP map Adcc '■ T~Lb 



^) on Bob's side such that 



Adoc o f o Ae 



< e 



(79) 



where I 



is the identity channel, and the rate of the code is given by R. Furthermore, an 



asymptotic code for £ is a sequence of e„-error codes for f with rate i?„ such that lim„_j.oo e„ = 0, and the 
corresponding asymptotic rate is given by i? = limsup„_5.Q^ The quantum capacity Q{E) is then defined as the 
minimal asymptotic rate of asymptotic codes for £ . 

Note that there are slightly different ways to define the quantum capacity, and we could use other distance measures 
(like the entanglement fidelity or the channel fidelity) in (79). Yet, it was as shown that all definitions lead to the 
same capacity (see Lemma 45 taken from [S3]). Similarly, we can define the quantum capacity in the presence of 
free classical forward communication from the sender to the receiver, denoted by Q^, the quantum capacity in the 
presence of free classical backward communication from the receiver to the sender, denoted by and the two-way 
classical communication assisted quantum capacity Q^^. 

As our argument makes crucial use of the idea of simulating a noisy channel with perfect, noise- free, channels, we now 
first establish a strong converse for the identity channel. For the unassisted quantum capacity this is straightforward, 
and can be understood in terms of the impossibility of compressing n qubits into a smaller storage device. 

Lemma 20. Let I2 be the qubit identity channel. Then we have for every sequence of £„-error codes for if^ with 
asymptotic rate R that 



> 1 - 2-«(^-i) 



(80) 



Proof. For Kraus decompositions {-Ej}, {Dk} of the CPTP maps Acne, Adcc respectively, we get for the channel fidelity 



tr 



1 

2^ 



< 



1 

—5 > tr 

>nR / y 



DkEj 



2nR 



<^tr 



DkEj 



1 

2^ 



44 



tr 



n, 



1 

2^ 



trpfc] < 2-"(-«-i) 



(81) 
(82) 



where 11^ denotes the projector onto the subspace to which Dk maps, and the first inequality follows from the 
Cauchy-Schwarz inequality. By Fc{£) > i — \\£ — ^\\o (Lemma 45) this implies the claim. □ 

This can be generalized to the case of free classical communication assistance. 

Corollary 21. Let I2 be the qubit identity channel. Then we have for every sequence of classical communication 
assisted £„-error codes for Xf"" with asymptotic rate R that 



> 1 - 2-"(«-i) . 



(83) 



Proof. Since back communication is allowed, the general form of a protocol consists of potentially many rounds of 
forward quantum and classical communication as well as backward classical communication. We first analyze one 
such round, which has without lost of generality the following form: 

1. CPTP map T)^ at the receiver with Kraus operators {Dj} 

2. Classical communication from the receiver to the sender, denoted by the register B 

3. CPTP map £ at the sender with Kraus operators {Ej i,} — {Ejj, (g) |6)(6|b} 

4. Classical communication from the sender to the receiver, denoted by the register F 



5. CPTP map at the receiver with Kraus operators Wl j} = {Df j (g) |/)(/|f} 
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The channel fidehty after this round can be estimated as before (Lemma 20 ) 

2 

2nR 



o (If" ®Xf)o8oIboV^)^ 

ijkbf 



tr 



ijkbf 



2nR 









)1 


tr 





(84) 

(85) 
(86) 



where 11^ j denote the projector onto the subspacc that Dj, ^ maps. It is now easily seen that adding more rounds 
does not affect the argument; the projectors 11 are just chosen such that they project on the subspaces to which the 
Kraus operators of the last CPTP map at the receiver map to. □ 

To generalize this to arbitrary quantum channels we need one more ingredient. We need to show that the asymptotic 
channel simulation for some quantum channel (as discussed in Theorem 11) can be done for an error rate which is 
exponentially small in n. 

Lemma 22. Let S : £{'Ha) — >■ C,{T-Lb) be a CPTP map and 5i > 0. Then, there exists an asymptotic channel 
simulation for £ with an entanglement cost of Ec + Si and an error 



(n + 1) 



8(log(|i3|+3))^ 



(87) 



Proof. In the proof of Lemma [121 we can choose the error (5„ in the one-shot entanglement cost protocol for the de 

1.2" S(log(|B|+3))^ 



Finetti state ujbA'E defined in (22)) as 



By (21) this leads to a total error rate of 



(n + 1) 



8(log(|i3|+3))^ 



for the asymptotic channel simulation, and by ( 30 ) the entanglement cost for this is 
Since 



n- min maxH{B\R)^j 



+ V^-\og {\B\ + 3) • Jlog + 2 • log(n + 1) • {\A\^ ~ l) . (89) 



lim — 



/^•log(|i?|+3) 




^1 



we get an entanglement cost of Eq + Si (by considering the rest of the proof of the direct part of Theorem 
is. Lemma 13 and Proposition 14 1. 
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(90) 

that 

□ 



Using this lemma, we can now finally prove the following upper bound on the strong converse quantum capacity. 
The main idea of our proof is argue by contraction: we show that if we were able to send quantum information at 
a rate exceeding Ec, then we could effectively send information through a perfect channel at a higher rate than is 
allowed by Corollary |21| Since our upper bound holds for any classical communication assistance, we henceforth only 
talk about Q^. 

Theorem 23. Let £ : C{Ha) £{T~1.b) be a CPTP map and $2 > Si > 0. Then for every sequence of two-way 
classical communication assisted £„-error codes for with asymptotic rate R — Ec{£) + S2, we have 

£n > 1 - ("- + 1)''^''"^ • 2""'«(i°<!(is'i+3))2 - 2~"'4W+5i"i = 1 - 2"°(") . (91) 

Proof. Consider the following Gedankenexperiment. Start with the perfect qubit identity channel I2 and do an 
asymptotic channel simulation for £ as defined in Definition 10 As we have just seen this can be done for an 

^ _ if I 

entanglement cost Ec{£) + Si and an exponentially small error a„ = (rt + l)l'^l ^^-2 " **<i°k(I-bi+3))^ (Lemma 22). Now 
suppose that there existed a hypothetical asymptotic code for £ allowing us to send information at a rate R = Ec + S2 
for an error rate e„ > 0. Hence, in total, we would have an asymptotic code for I2 at a rate > 1 for some 
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error rate 7„ > 0. But by the triangle inequality of the metric induced by the diamond norm and Corollary 21 we 
know that 

(n + 1)1-^1 -1 • 2 "■«(>°K(i«i+=*»' +£„ > 7„ > 1 - - • 2 "■Uc(^)+^i 'J, (92) 

and thus we are done. □ 
We expect that the upper bound given by the entanglement cost is typically far from being tight. We can compare 



the quantum capacities of qubit channels with our upper bound from ( 77 1 



Ec{Sa^b) < EUEa^b) = + ^ • - {{£a^b®Ta') (^aa'))) 



(93) 



where h{-) denotes the binary Shannon entropy, and C(-) is defined as in (75). For Q^{£) this can e.g. be evaluated 
for all degradable qubit channels [54[ I55j . As an example we mention the qubit dephasing channel £dcph(p) = 

(1 — p)p + p ■ GzpcFz with Gz = ' ^"-"^ which we get 

Q^(fdcph) = 1 - h{p) <h{]^ + Vp(I-p)) = ^c(^dcph) < 1 - ^ • K\) = QEiSdoph) . (94) 

where h{-) denotes the binary Shannon entropy [56 . As shown in Fig. [5j this is far from being tight. However, 
since Q^^ (and also Q<-) can be much larger than Q~^, and since not too much is known about these capacities, the 
following upper bound might be useful. We have for every qubit channel £a-^b that 



(95) 



U 0.4- 
0.2 

0.0 ; 



0.0 0.1 0.2 0.3 0.4 0.5 

P 



FIG. 5. The qubit dephasing channel with dephasing parameter p - quantum capacity Q (dotted line) vs. upper bound on 
the entanglement cost (solid line) vs. entanglement assisted quantum capacity Qe (dashed line). 



V. DISCUSSION AND OUTLOOK 

We calculated the rate of entanglement needed in order to asymptotically simulate a quantum channel when classical 
communication is for free. Because of the free classical communication, the problem is equivalent to the question about 
the rate of quantum communication needed in order to simulate a quantum channel. A natural subsequent question is 
to ask what rate of classical communication is actually needed. However, in the spirit about general quantum channel 
simulations, we might even want to ask more generally about rate triples (q, e, c) needed in order to achieve the channel 
simulation. Here q denotes quantum communication, e entanglement, and c classical communication. The quantum 
reverse Shannon theorem can then be understood as e.g. {Qe, oo,0) or (0,oo,C£;), whereas our entanglement cost 
corresponds to e.g. (0, Ec,oo) or (Ec,0,oo). Some more examples are discussed in [S] Figure 2] and a particularly 
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interesting case is the following. For e = 0, c = 0, and product state inputs, the channel simulation can be done for [SI 
Theorem 3] 

q = lim -Ep ((f^^s §51^0 {<t>AA'f'") (96) 

n— s-oo n \ / 

with (pAA' the maximally entangled state, and Ep the entanglement of purification |57j 

Ep{pab) = min Ef{paa'BB') ■ (97) 

Paa'bb' ■^■''a'b' Hp) {p\aa' bb']=Pab 

Now one could hope to generalize this to a channel simulation for general input states using the techniques presented 
above, leading to 

q = lim - maxEp ® Ia') {^1a')) , (98) 

where V'aa' ^ V(H^" ® "H^,"), and "Ha' — T^a- However, this does not work for same reason as the quantum reverse 
Shannon theorem can not be proven for general input states using only maximally entangled states; an issue known 
as entanglement spread [51 [55H5D] . 

Another interesting open question concerns the relation of Ec{£) and Q^{£). We know that Ec{£) > Q^{£), 
with the inequality typically being strict. Can wc obtain a characterization of channels for which Ec{£) — Qm^{£)'? 
This is an analog of the problem of characterizing bipartite states for which the distillable entanglement is equal the 
entanglement cost, which is still wide open. 

Note added. After completion of this work, security in the noisy storage model was linked to the strong converse 
quantum capacity of the adversary's storage device |61j . This means that our bound on the strong converse from 
Section |TV]2] can also be applied directly to calculate rates for security. However, our arguments from Section [IV.!] 
apply to virtually any form of the noisy storage model, whereas the results from j61j are only applicable for the 
so-called six-state encoding. 



ACKNOWLEDGMENTS 



We acknowledge discussions with Jonathan Oppenheim, Michael Walter, Reinhard Werner, Mark Wilde, and An- 
dreas Winter. MB and MC are supported by the Swiss National Science Foundation (grant PP00P2-128455), the 
German Science Foundation (grants CH 843/1-1 and CH 843/2-1), and the National Centre of Competence in Re- 
search 'Quantum Science and Technology'. FB and SW are supported by the National Research Foundation and the 
Ministry of Education, Singapore. FB is supported by a " Conhecimento Novo" fellowship from the Brazilian agency 
Fundagao de Amparo a Pesquisa do Estado de Minas Gerais (FAPEMIG). MB, FB and SW would like to thank the 
Institute Mittag-LefHer (Djursholm, Sweden), where part of this work was done. 



Appendix A: Properties of Smooth Entropy Measures 

Lemma 24. ~2E', Lemma 10] Let pab G ^{T-Lab)- Then, 

HdA\B)p > H{A\B)p . (Al) 

Lemma 25. Let pA = Yl^^iPjfy'A ^ 'P{'Ha) with € ViHA) for j = 1, . . . , N. Then, 

Ho{A)p < maxi/o(^)p. + logiV . (A2) 

j 

Proof. We have rank(Af + iV) < rank(Af) + rank(7V) for Af, N e C{'Ha) [H Proposition 0.4.5] and hence 



PiPa 



- '"^"'^ {pjP'a)^ = log I^XJ '■^^'^ l*"^) j - ' '^l^'^^^^l^ (^^)) 

(A3) 

maxiJo(^)pj +log7V . (A4) 

3 



Ha{A)p = log I rank | ^ 

K3 = ^ 
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□ 

Lemma 26. Let e > 0, pab YlJ=iPjPAB ^ SiUAs), Pj > for j = 1, . . . , iV, and = Y^keK p'a ® I^X^Is 
with p-^*^ G V{Hab) and the Ifc)^ mutually orthogonal. Then, 

i?o(^l^)p < niaxiJ^(v4|B)„, +logiV . (A5) 

Proof. Let e Bqc{p\g) such that 77^(A|i3)p3 = i7o(^|-B)pj for each j = I, . . . ,N . Now define pAs = Z^jLi PjP'ab 
and note that p^is S B'^^{pab)- Using the definition of the alternative smooth conditional max-entropy and its form 
on quantum-classical states (Lemma [s]), it follows that 

H^{A\B)p < Ho{A\B), = maxi/o(v4)5:^p,p.,. . (A6) 

Using the preceding lemma (Lemma 251 and again the structure of quantum-classical states (Lemma [s]), we conclude 
maxi/o(A)^ „ V " < maxmaxi/o(A);jj,fc -I- logiV = ma.xHo{A\B)p, + \ogN ^ ma.xH^{A\B)„j -f logiV . (A7) 

keK Z^jPjPA keK j j j 

□ 

Lemma 27. Let £ > 0, pab — J2k Pa ® \ f^){l^\B G S{Hab), and the \k)B mutually orthogonal. Then, the smoothing 
in Hq(A\B)p can without lost of generality be restricted to states that commute with pab- 

Proof. The crucial step is to see that for every <tab = J2k'^A ® \^){^'^\b G B^Apab): there exists a unitary Uab — 
Yk ^A ® such that Uab(^abU\b ^ ^^^{pab) and [UAB<^ABU\g, pab] = 0. For this, just choose C/^ to be the 

unitary that maps the eigenbasis of to the eigenbasis of p^. Therefore [UAB'^ABU^g, pab] — Oi and furthermore 
by Lemma [40] 

e > Wpab - ctabWi = J2 Wpa - '^llli > E - Qa\\i = E Wpa " U^A<iU^A)^\\i = Wpab - UabctabUU\i , 

(A8) 

where P|, Qa denote the eigenvalue distributions of p\, a\ respectively. □ 

The definition of the smooth alternative conditional max-entropy can be specialized canonically to classical proba- 
bility distributions. 

Definition 28. Let e > 0, A" and Y be random variables with range X and y respectively, and joint probability 
distribution Pxy ■ The max-entropy of X conditioned on Y is defined as 

Ho{X\Y)p = maxlog |supp (F|) | , (A9) 

where denotes the function Pjr : x Pxy{x, y). The smooth max-entropy of X conditioned on Y is defined as 

Hl{X\Y)p= inf Ho{X\Y)p , (AlO) 

PxYeB'^iPxY) 

where B^{Pxy) denotes the set of non- negative linear functions Pxv : X x y ^ M+ such that HPxy — Pxy\\i < £• 

The following is an entropic formulation of the classical asymptotic equipartition property. 

Lemma 29. [63, Theorem 1] Let X and Y be random variables with range X and y respectively, and joint probability 
distribution Pxy- Furthermore let £ > 0, n > 1, and let F3J„y„ = PxiYi x . . . x Px„y„ be the n-fold product probability 
distribution over A"" x y". Then 



1 log(|A|+3)- Jlog(^) 

-iJo"(^"|i^")p" < HiX\Y)p + ^ — . (All) 

n yjn 

This can be generalized to the following quantum-classical asymptotic equipartition property. 
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Lemma 30. Let e > 0, n > 1, pab = p\ ® € S{Hab) and the \k)B mutually orthogonal. Then, 



1 log(|A|+3). Jlog(i) 

-HI{A\B)^^,. < H{A\B), + ^ 



(A12) 



Proof. The basic idea is that by Lemma 27 the smoothing of the alternative conditional max-entropy can be restricted 
to states that commute with the initial state, and hence all states that appear are diagonal in the same basis. Working 
in this basis, this then allows us to use the classical asymptotic equipartition property (Lemma 29). In more detail, 
we calculate 



-Hl{A\B)p^^^- min Hq{A\B)p^ = - min Ho{A\B)p. , 



(A13) 



where the second equality is due to Lemma 27 PjJ^ is the eigenvalue distribution of p^j^, and yB^(-) is defined as in 
Definition 28 Moreover, we conclude by the definition of the classical smooth conditional max-entropy (Definition 28 1 , 
and the classical asymptotic equipartition property (Lemma 29 ) 

1 



1 log(|A|+3). Jlog(i) 
min Ho{A\B)p^ - -H'^{A\B)p^ < H{A\B)p + ^ — 



= H{A\B), 



log(|A|+3).y^log(i) 



where Pab denotes the eigenvalue distribution of pab ■ 



(AM) 

(A15) 

□ 



Appendix B: The Post-Selection Technique 

We use a norm on the set of CPTP maps which measures the probability by which two such mappings can be 
distinguished. The norm is known as diamond norm in quantum information theory |27j . Here, we present it in a 
formulation which highlights that it is dual to the well-known completely bounded (cb) norm |64) . 

Definition 31. Let £a '■ C{Ha) £{Hb) be a linear map. The diamond norm oi £a is defined as 

\\£A\\o=SUp\\£A®Ik\\l , (Bl) 

feeN 

where ||J^||i = sup^g^^^^^ ||J^(ct)||i and Xk denotes the identity map on states of a fc-dimensional quantum system. 



Proposition 32. [271 [64] The supremum in Definition 31 is reached for k = \A\. Furthermore the diamond norm 
defines a norm on the set of CPTP maps. 

Two CPTP maps £ and are called e-close if they are £-close in the metric induced by the diamond norm. The 
following proposition lies at the heart of the post-selection technique. 

Proposition 33. ED Let e > and and J''^ be CPTP maps from £{Hf) to C{Hb)- If there exists a CPTP 
map for any permutation tt such that {£a — J^a) ° = ° {£2 ~ -^a)' then £"2 and J^a ^-^^ e-close whenever 

\\m-^l)®lRR'mpn,)\\,<sin + l)-(\^\'-'^ , (B2) 

where Carr' is a purification of the de Finetti state (ar — I '^AR^i'^^n) ^^^^ '^^R ^ ^{'H.a^'Hr)^ Ha — 'Hr and d{-) 
the measure on the normalized pure states on T-La ® T^r induced by the Haar measure on the unitary group acting on 
'Ha(S)T-Lr, normalized to / d{-) = 1. Furthermore we can assume without loss of generality that \R'\ < {n + l)'"^' 



Lemma 34. 6, Corollary D.6] Let Ca_r = / '^AR^i'^AR) as in Proposition 33 Then = J2iPi {^ar}'^"^ with 
uj\p e VCHa <8) Hr), i e {l,2,...,{n+ l)2|A||fl|-2|^ ^^^^ j^j ^ probability distribution. 
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Appendix C: Technical Lemmata 

Lemma 35. j25i Lemma 6] Let p, <t G S<{H). Then 

I'Wp- a||i < P{p,a) <V\\P- '^lli + Mp] - tr[a]| . (CI) 

Lemma 36. 62J Let M e C"'''' for a,beN. Then ||M||2 < ||M||i < ^/mnk{M) ■ \\M\\2. 

Lemma 37. 65, Section 5.2] Let M e C"'''' and e C''''^ for a, 6, c e N. Then \\M ■ N\\2 < ||M||2||Af||2- 

Lemma 38. Let < e < 1 and D,d > 0. Furthermore let J\f^ = {w G \ \\w\\2 < £)} and let T be some subset 

of J\fj^. Then, there exists a subset Te QT with |7^| < + l)^'', such that for every vector v <E T , there exists a 
vector € 7^ with \\v — v^\\2 < e. 

Proof. The proof is inspired by |66l Lemma n.4]. Let Te = {vi}i=i.,,.^m be a maximal subset of w G 7" satisfying 
Iki — Vj\\2 > £ for all It remains to estimate m. As subsets of M^'', the open balls of radius e/2 about each 

Vi Te are pairwise disjoint, and all contained in the ball of radius D + e/2 centered at the origin. Hence 

m- (e/2)''^ < (0 + 6/2^ . (C2) 

□ 

Lemma 39. Corollary 3.3] Let X and Y be convex, compact sets and / a real valued function on X x Y, that 
is convex in the first argument, concave in the second argument and continuous in both. Then, 

inf sup /(x, y) = sup inf f{x, y) . (C3) 

Lemma 40. [57] Let p^cr & 'P{'H), and denote the corresponding eigenvalue distribution by Px,Qx respectively. 
Then, 

\\p-<j\\i>\\Px~Qx\\i . (C4) 
Lemma 41. Theorem 1] Let pA, (Ja € S{Ha) with pA ~e o^a for some e > 0. Then, 

\H{A)p - H{A)„)\ < e ■ \og{\A\ - 1) + h{e) , (C5) 
where h{-) denotes the binary Shannon entropy. 

Lemma 42. 691 paBjCtab G S{Hab) with \\pab — ctabWi < £ for some £ > 0. Then, 

\H{A\B)p - H{A\B),\ < 4£ • log \A\ + 2h{e) , (C6) 
where h[-) denotes the binary Shannon entropy. 

Lemma 43. Let pab^cfab G S{'Hab) with pab ~e o^ab for some e > 0. Then, 

\Ef{pab) - EF{aAB)\ < &£ ■ log \A\ + 2h{2e) , (C7) 
where h{-) denotes the binary Shannon entropy. 

Proof. The proof is the same as the original one |70j . but uses the (improved) continuity of the conditional von 
Neumann entropy (Lemma 42) instead of the continuity of the unconditional von Neumann entropy (Lemma |41| . □ 



Lemma 44. [71, Lemma 1] Let pab G S{'Hab)- Then the minimization over all pure states decompositions 
Pab — '^iPiPAB l'^ the entanglement of formation Ep{pab) = rninjp. pij X]iPi-^(^)p' (Definition [l]) , is taken for a 
decomposition with at least rank(pyiB) and at most T:a'nk{pABY elements. 



Such a subset can be constructed by starting with an arbitrary vector vi £ T, as a next step taking another vector V2 d T with 
||fl — V2\\2 > £, and then i>3 S 7" with \\v\ — v^\\2 > £, \\v2 — «3||2 > £ etc. A subset constructed like this becomes maximal as soon as 
it is not possible to add another vector w^, £ T, such that \\vk — Vi\\2 > e for all vectors Vi that are already in the subset. 
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Lemma 45. '53', Proposition 4.3] Let £ : C{Ha) '—>■ ^{Hb) be a quantum channel. Then, 

/ X 1/4 

1- min F,{p,£)<i^l-F,{£)<A^\\£-I\\^<8il- min F,{p,£)] , (C8) 
pes{HA) \ peS{HA) J 

where Fc{£) — {<j)\{£ ®I){cj))\<j)) with (j)AA' the maximaUy entangled state on 'Ha'^^'Ha', and Fe{p,£) — {p\{£®I){p)\p) 
with pAA' G V{'Ha ® Ha') a purification of pA- 
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